> -----Original Message----- > From: Paul Whittney > After reading some of the items here, I thought to take a > look at my logs, and see if there is a pattern of spam/ham to > the $MessageID. > > First problem I had was that I hadn't got the filter logging > the info, so I've started syslogging > filter_(subroutine),$QueueID,$MessageId,.....
sendmail logs this, so you don't need to have a separate log in MD. k57FI4Sh026183: from=<[EMAIL PROTECTED]>, size=2974, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=mx.example.com [192.0.2.15] > Found, for example: > k57Cmi17006408,spam, 7.398, <[EMAIL PROTECTED]> > k57D7ZbK006518,spam, 7.398, <[EMAIL PROTECTED]> > k57DNX0K006687,spam,15.212, <[EMAIL PROTECTED]> > k57DP8Vs006708,spam, 8.249, <[EMAIL PROTECTED]> > k57DYuvp006769,spam,26.097, <[EMAIL PROTECTED]> > k57CqfVK006437,spam,28.497, > <[EMAIL PROTECTED]> > > Following this, I was thinking that having sort sort of > signature, or fingerprint for an email (like nmap's > fingerprints of OS's), but then I suppose this is what Razor > (etc...) do? This particular fingerprint would be from a little used program called MS Outlook Express. Block this, and your volume of mail will go WAY down. _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list [email protected] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
